CVE-2026-102386

The WP Photo Album Plus WordPress plugin, version 9.3.02.003 and below, contains a Subscriber Cross Site Scripting (XSS) vulnerability. While the specific root cause and internal component are not detailed in the provided documents, the vulnerability allows for XSS impacts. No exploit details or ...

EUVD-2026-89942

Subscriber Cross Site Scripting XSS in WP Photo Album Plus = 9.3.02.003 versions...

CVE-2026-102386 WordPress WP Photo Album Plus plugin <= 9.3.02.003 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in WP Photo Album Plus = 9.3.02.003 versions...

WordPress WP Photo Album Plus plugin <= 9.3.02.003 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by neurotx in WordPress Plugin WP Photo Album Plus versions = 9.3.02.003...

PT-2026-103141

Subscriber Cross Site Scripting XSS in WP Photo Album Plus = 9.3.02.003 versions...

CVE-2026-102386: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in WP Photo Album Plus = 9.3.02.003 versions...

CVE-2026-93774

Unauthenticated Cross Site Scripting XSS in WP Photo Album Plus = 9.3.02.002 versions...

CVE-2026-93774

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in the WP Photo Album Plus WordPress plugin, affecting versions

CVE-2026-93774 WordPress WP Photo Album Plus plugin <= 9.3.02.002 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WP Photo Album Plus = 9.3.02.002 versions...

CVE-2026-93774 WordPress WP Photo Album Plus plugin <= 9.3.02.002 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WP Photo Album Plus = 9.3.02.002 versions...

EUVD-2026-85468

Unauthenticated Cross Site Scripting XSS in WP Photo Album Plus = 9.3.02.002 versions...

CVE-2026-96673

Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the albumid path segment. Attackers can supply crafted SQL expressions in the albumid parameter to extract arbitrary data from the databa...

CVE-2026-96673 Photoview through 2.4.0 SQL Injection via album download route

Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the albumid path segment. Attackers can supply crafted SQL expressions in the albumid parameter to extract arbitrary data from the databa...

CVE-2026-96673 Photoview through 2.4.0 SQL Injection via album download route

Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the albumid path segment. Attackers can supply crafted SQL expressions in the albumid parameter to extract arbitrary data from the databa...

WordPress WP Photo Album Plus plugin <= 9.3.02.002 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin WP Photo Album Plus versions = 9.3.02.002...

CVE-2026-93774: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WP Photo Album Plus = 9.3.02.002 versions...

PT-2026-97453

Name of the Vulnerable Software and Affected Versions WP Photo Album Plus versions prior to 9.3.02.003 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication...

CVE-2026-96673: Improper Neutralization of Special Elements used in an SQL Command

Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the albumid path segment. Attackers can supply crafted SQL expressions in the albumid parameter to extract arbitrary data from the databa...

PT-2026-97359

Name of the Vulnerable Software and Affected Versions Photoview versions prior to 2.4.1 Description An SQL injection issue exists in the album download route. Unauthenticated attackers can inject SQL by manipulating the album id path segment. By supplying crafted SQL expressions in the album id...

CVE-2026-87909

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppaimagemagick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec, with only...